The short answer: make an authenticator app on your phone your default. It is far safer than SMS, does not depend on the mobile network, and works with almost every service. For anything you cannot afford to lose (your main e-mail, your hosting account, your domain), a physical security key is better still. SMS is only better than nothing.
Two-step verification (2FA) adds a second proof after the password. Whoever learns your password, through your own slip or a data leak, is still stuck at the door. But “two steps” does not mean “equally safe”: the second step comes in three very different kinds.
The three kinds, side by side
| Kind |
How it works |
Weak point |
| Authenticator app |
The app on your phone generates a new code every few seconds. You type it after your password. |
If you lose the phone without having saved the recovery codes, you are stuck. |
| SMS |
You receive the code as a text message on your registered number. |
It can be diverted: someone who talks the operator into moving your number to another SIM card receives your codes. It also needs signal. |
| Security key |
A physical device (USB or NFC), or the passkey stored on your phone, proves it is really you, and only on the genuine address. |
Not every service supports it. You should keep a second key as a spare. |
How to choose, step by step
| 1 |
Start with the accounts that open the others. The e-mail you use to recover passwords, Meu Interweb, your password manager. Whoever gets into your e-mail can reset almost everything else.
|
|
| 3 |
Use the security key on the accounts your business depends on, if the service accepts one and you are willing to keep a spare.
|
|
| 4 |
Settle for SMS only when it is the sole option. It is still much better than relying on the password alone.
|
|
| 5 |
Save the recovery codes somewhere other than your phone, printed or in a safe place. It is the difference between two minutes and two days when the phone goes missing.
|
|
|
Never read a code out to anyone, not even to someone claiming to be Interweb, your bank or WhatsApp. The code is for you. Anyone asking for it on the phone or in a message is trying to get into your account at that very moment. The same goes for codes that arrive when you did not ask for them: someone has just typed in your password.
|
What about WordPress and the site e-mail?
The Meu Interweb verification protects Meu Interweb only. The WordPress dashboard has its own entrance, which you protect with an authentication plugin, as protecting the WordPress login explains. Mailboxes created in cPanel have a password but no two-step verification, so those passwords need to be long and unique, as in a strong password and a password manager.
|
Set the authenticator app up on two devices, if you have two, at the moment you switch the service on. Some apps keep an encrypted copy in the cloud: check whether yours does before you change phone. If you still lose access, read what to do when you are locked out.
|
RECOMMENDED PRODUCT Web hosting with cPanel Domain and SSL included, daily backups and the panel you already know. from 5.940,00 Kz/mo (3-year plan, with coupon) See plans |
Português
English
